CIRCL/vulnerability-attack-techniques huggingface dataset:
CVE-2020-11023: Potential XSS vulnerability in jQuery
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Affected products: jquery jQuery
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
ATT&CK exploitation technique(s): T1204.001
ATT&CK primary impact: T1059.007
ATT&CK secondary impact: T1557
ATT&CK techniques (all): T1059.007, T1204.001, T1557
CVE-2011-1331: 
JustSystems Ichitaro 2005 through 2011, Ichitaro Government 6, Ichitaro Government 2006 through 2010, Ichitaro Portable, Ichitaro Pro, and Ichitaro Viewer allow remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted document, as exploited in the wild in early 2011.

ATT&CK techniques (all): T1068, T1190
CVE-2020-15109: Ability to change order address without triggering address validations in solidus
In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted. See the linked reference for more information. As a workaround, if it is not possible to upgrade to a supported patched version, please use this gist in the references section.

Affected products: solidusio solidus
CWE: CWE-20: Improper Input Validation
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
ATT&CK exploitation technique(s): T1133
ATT&CK primary impact: T1190
ATT&CK secondary impact: T1565
ATT&CK techniques (all): T1133, T1190, T1565
CVE-2022-20699: Cisco Small Business RV Series Routers Vulnerabilities
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.

Affected products: Cisco Cisco Small Business RV Series Router Firmware
CWE: CWE-121
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1133
ATT&CK primary impact: T1059.004
ATT&CK techniques (all): T1059.004, T1133
CVE-2023-26369: [Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wild
Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Affected products: Adobe Acrobat Reader
CWE: CWE-787 Out-of-bounds Write (CWE-787)
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1204.002
ATT&CK primary impact: T1203
ATT&CK techniques (all): T1203, T1204.002
CVE-2010-2743: 
The kernel-mode drivers in Microsoft Windows XP SP3 do not properly perform indexing of a function-pointer table during the loading of keyboard layouts from disk, which allows local users to gain privileges via a crafted application, as demonstrated in the wild in July 2010 by the Stuxnet worm, aka "Win32k Keyboard Layout Vulnerability."  NOTE: this might be a duplicate of CVE-2010-3888 or CVE-2010-3889.

ATT&CK techniques (all): T1068
CVE-2014-6271: 
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock."  NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.

CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1133, T1190
ATT&CK primary impact: T1059.004
ATT&CK techniques (all): T1059.004, T1133, T1190
CVE-2020-5225: Log injection in SimpleSAMLphp
Log injection in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script, which receives error reports and sends them via email to the system administrator, did not properly sanitize the report identifier obtained from the request. This allows an attacker, under specific circumstances, to inject new log lines by manually crafting this report ID. When configured to use the file logging handler, SimpleSAMLphp will output all its logs by appending each log line to a given file. Since the reportID parameter received in a request sent to www/errorreport.php was not properly sanitized, it was possible to inject newline characters into it, effectively allowing a malicious user to inject new log lines with arbitrary content.

Affected products: simplesamlphp SimpleSAMLphp
CWE: CWE-532: Inclusion of Sensitive Information in Log Files
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
ATT&CK exploitation technique(s): T1133
ATT&CK primary impact: T1190
ATT&CK secondary impact: T1565
ATT&CK techniques (all): T1133, T1190, T1565
CVE-2024-30051: Windows DWM Core Library Elevation of Privilege Vulnerability
Windows DWM Core Library Elevation of Privilege Vulnerability

Affected products: Microsoft Windows 10 Version 1809, Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows 11 version 21H2, Microsoft Windows 10 Version 21H2, Microsoft Windows 11 version 22H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation)
CWE: CWE-122: Heap-based Buffer Overflow
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
ATT&CK primary impact: T1068
ATT&CK techniques (all): T1068
CVE-2017-9822: 
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."

Affected products: DotNetNuke DotNetNuke CMS Fixed in 9.1.1
CWE: Remote Code Execution via untrusted deserialization of Xml data, CWE-94 Improper Control of Generation of Code ('Code Injection')
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1059
ATT&CK secondary impact: T1496
ATT&CK techniques (all): T1059, T1190, T1496
CVE-2017-16651: 
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.

CWE: CWE-552 Files or Directories Accessible to External Parties
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1005, T1190
CVE-2019-11634: 
Citrix Workspace App before 1904 for Windows has Incorrect Access Control.

CWE: CWE-284 Improper Access Control
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1059
ATT&CK secondary impact: T1003, T1005, T1046, T1078, T1486
ATT&CK techniques (all): T1003, T1005, T1046, T1059, T1078, T1190, T1486
CVE-2019-16759: 
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.

CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1190
CVE-2019-9791: 
The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just-in-time (JIT) compiler and when the constructor function is entered through on-stack replacement (OSR). This allows for possible arbitrary reading and writing of objects during an exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.

Affected products: Mozilla Thunderbird, Mozilla Firefox ESR, Mozilla Firefox
CWE: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey
ATT&CK techniques (all): T1203
CVE-2017-14486: 
The Vibease Wireless Remote Vibrator app for Android and the Vibease Chat app for iOS use cleartext to exchange messages with other apps and the PLAIN SASL mechanism to send auth tokens to Vibease servers, which allows remote attackers to obtain user credentials, messages, and other sensitive information by sniffing the network for XMPP traffic.

ATT&CK techniques (all): T1499.004, T1548
CVE-2019-3778: Open Redirect in spring-security-oauth2
Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the "redirect_uri" parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code. This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and uses the DefaultRedirectResolver in the AuthorizationEndpoint. This vulnerability does not expose applications that: Act in the role of an Authorization Server and uses a different RedirectResolver implementation other than DefaultRedirectResolver, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient).

Affected products: Spring Spring Security OAuth
CWE: CWE-601: Open Redirect
ATT&CK exploitation technique(s): T1566.002
ATT&CK secondary impact: T1036
ATT&CK techniques (all): T1036, T1566.002
CVE-2020-3253: Cisco Firepower Threat Defense Software Shell Access Vulnerability
A vulnerability in the support tunnel feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access the shell of an affected device even though expert mode is disabled. The vulnerability is due to improper configuration of the support tunnel feature. An attacker could exploit this vulnerability by enabling the support tunnel, setting a key, and deriving the tunnel password. A successful exploit could allow the attacker to run any system command with root access on an affected device.

Affected products: Cisco Cisco Firepower Threat Defense Software
CWE: CWE-284
CVSS: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1078
ATT&CK primary impact: T1059
ATT&CK techniques (all): T1059, T1078
CVE-2021-27103: 
Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.

CWE: CWE-918 Server-Side Request Forgery (SSRF)
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK secondary impact: T1005
ATT&CK techniques (all): T1005, T1190
CVE-2015-4902: 
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.

CWE: CWE-284 Improper Access Control
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
ATT&CK techniques (all): T1190
CVE-2022-28810: 
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.

CWE: CWE-798 Use of Hard-coded Credentials
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK techniques (all): T1190
CVE-2019-1736: Multiple Cisco UCS-Based Products UEFI Secure Boot Bypass Vulnerability
A vulnerability in the firmware of the Cisco UCS C-Series Rack Servers could allow an authenticated, physical attacker to bypass Unified Extensible Firmware Interface (UEFI) Secure Boot validation checks and load a compromised software image on an affected device. The vulnerability is due to improper validation of the server firmware upgrade images. An attacker could exploit this vulnerability by installing a server firmware version that would allow the attacker to disable UEFI Secure Boot. A successful exploit could allow the attacker to bypass the signature validation checks that are done by UEFI Secure Boot technology and load a compromised software image on the affected device. A compromised software image is any software image that has not been digitally signed by Cisco.

Affected products: Cisco Cisco Identity Services Engine Software
CWE: CWE-347
CVSS: CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
ATT&CK primary impact: T1542.001
ATT&CK techniques (all): T1542.001
CVE-2023-41179: 
A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation.

Note that an attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.

Affected products: Trend Micro, Inc. Trend Micro Apex One, Trend Micro, Inc. Trend Micro Worry-Free Business Security, Trend Micro, Inc. Trend Micro Worry-Free Business Security Services, trendmicro apex_one, trendmicro worry-free_business_security, trendmicro worry-free_business_security_services
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1078
ATT&CK primary impact: T1059
ATT&CK techniques (all): T1059, T1078
CVE-2020-11036: XSS in GLPI
In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is vulnerable to Stored XSS in the comments of items in the Knowledge base. Adding a comment with content "<script>alert(1)</script>" reproduces the attack. This can be exploited by a user with administrator privileges in the User-Agent field. It can also be exploited by an outside party through the following steps: 1. Create a user with the surname `" onmouseover="alert(document.cookie)` and an empty first name. 2. With this user, create a ticket 3. As an administrator (or other privileged user) open the created ticket 4. On the "last update" field, put your mouse on the name of the user 5. The XSS fires This is fixed in version 9.4.6.

Affected products: glpi-project GLPI
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
ATT&CK exploitation technique(s): T1189
ATT&CK primary impact: T1059.007
ATT&CK secondary impact: T1185
ATT&CK techniques (all): T1059.007, T1185, T1189
CVE-2018-0560: 
Hatena Bookmark App for iOS Version 3.0 to 3.70 allows remote attackers to spoof the address bar via vectors related to URL display.

Affected products: Hatena co.,ltd. Hatena Bookmark App for iOS
CWE: Address bar spoofing
ATT&CK techniques (all): T1036, T1211
CVE-2024-12987: DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection
A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of the argument session leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.5 is able to address this issue. It is recommended to upgrade the affected component.

Affected products: DrayTek Vigor2960, DrayTek Vigor300B
CWE: CWE-78 OS Command Injection, CWE-77 Command Injection
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
ATT&CK exploitation technique(s): T1068
ATT&CK primary impact: T1059
ATT&CK techniques (all): T1059, T1068
CVE-2019-16009: Cisco IOS and Cisco IOS XE Software Web UI Cross-Site Request Forgery Vulnerability
A vulnerability in the web UI of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the targeted user. If the user has administrative privileges, the attacker could alter the configuration, execute commands, or reload an affected device.

Affected products: Cisco Cisco IOS 12.2(15)B
CWE: CWE-352
CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1204.001
ATT&CK primary impact: T1608
ATT&CK techniques (all): T1204.001, T1608
CVE-2023-34048: VMware vCenter Server Out-of-Bounds Write Vulnerability
vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.

Affected products: VMware VMware vCenter Server, VMware VMware Cloud Foundation (VMware vCenter Server), vmware vcenter_server, vmware cloud_foundation
CWE: CWE-787 Out-of-bounds Write
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK primary impact: T1203
ATT&CK secondary impact: T1588.001
ATT&CK techniques (all): T1203, T1588.001
CVE-2018-7600: 
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

Affected products: Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1
CWE: remote code execution, CWE-20 Improper Input Validation
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1059
ATT&CK secondary impact: T1485, T1496
ATT&CK techniques (all): T1059, T1190, T1485, T1496
CVE-2020-5295: Local File read vulnerability in OctoberCMS
In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).

Affected products: octobercms october
CWE: CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
ATT&CK exploitation technique(s): T1133
ATT&CK primary impact: T1005
ATT&CK techniques (all): T1005, T1133
CVE-2019-3786: BBR could run arbitrary scripts on deployment VMs
Cloud Foundry BOSH Backup and Restore CLI, all versions prior to 1.5.0, does not check the authenticity of backup scripts in BOSH. A remote authenticated malicious user can modify the metadata file of a Bosh Backup and Restore job to request extra backup files from different jobs upon restore. The exploited hooks in this metadata script were only maintained in the cfcr-etcd-release, so clusters deployed with the BBR job for etcd in this release are vulnerable.

Affected products: Cloud Foundry BOSH Backup and Restore
CWE: CWE-269: Improper Privilege Management
CVSS: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
ATT&CK exploitation technique(s): T1565.001
ATT&CK primary impact: T1005
ATT&CK techniques (all): T1005, T1565.001
CVE-2025-24085: 
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3, watchOS 11.3. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2.

Affected products: Apple iOS and iPadOS, Apple iPadOS, Apple macOS, Apple tvOS, Apple visionOS, Apple watchOS
CWE: A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2., CWE-416 Use After Free
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1068
ATT&CK primary impact: T1059
ATT&CK techniques (all): T1059, T1068
CVE-2017-12824: 
Special crafted InPage document leads to arbitrary code execution in InPage reader.

Affected products: InPage InPage reader
CWE: Special crafted InPage document leads to arbitrary code execution
ATT&CK techniques (all): T1203
CVE-2018-8607: 
A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly sanitize a specially crafted web request to an affected Dynamics server, aka "Microsoft Dynamics 365 (on-premises) version 8 Cross Site Scripting Vulnerability." This affects Microsoft Dynamics 365. This CVE ID is unique from CVE-2018-8605, CVE-2018-8606, CVE-2018-8608.

Affected products: Microsoft Microsoft Dynamics 365
CWE: Spoofing
ATT&CK primary impact: T1059
ATT&CK secondary impact: T1005, T1036, T1485, T1565
ATT&CK techniques (all): T1005, T1036, T1059, T1485, T1565
CVE-2023-2136: 
Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Affected products: Google Chrome
CWE: CWE-190 Integer Overflow or Wraparound
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1204.001
ATT&CK techniques (all): T1204.001